Supplier qualification
How to verify a supplier's AS9100, ISO 9001, ITAR and UL claims
A certificate PDF on a sales deck is a claim, not evidence. Most of the credentials a cable assembly or wire harness supplier lists can be checked against an independent record in a few minutes. This page shows where each record lives and what to read when you find it.
Why a PDF is not enough
A certificate can be expired, suspended, withdrawn, issued by an unaccredited body, or issued to a different site or a narrower scope than the one quoting your part. None of that is visible on a well-formatted PDF. The independent record is what a customer auditor will look at, so it is the record you should look at before you issue a purchase order, and again at requalification.
Ask the supplier for the certificate number, the certification body, the certified site address and the scope. Then check each item against the table below.
Where each credential can be checked
| Credential | Independent record | What to confirm |
|---|---|---|
| AS9100, AS9110, AS9120 | IAQG OASIS database (user login, no charge for a basic account) | Listed, current status, certified site, scope, certification body, last audit |
| ISO 9001 | IAF CertSearch, or the certification body's own register | Accredited certification body, scope, site, expiry |
| IATF 16949 | IATF certificate check on the IATF Global Oversight site (needs the certificate number) | Valid certificate, certified client name |
| ITAR registration (DDTC) | The supplier's current DDTC registration letter; the DDTC public portal explains the registration process | Company name, expiry date, that it is current |
| SAM.gov registration, CAGE code | SAM.gov entity search; the DLA CAGE search | Active registration, legal name and address match, CAGE code |
| Federal exclusions | SAM.gov exclusions search | No active exclusion for the entity or its principals |
| UL Recognized wiring harness (ZPFW2) | UL Product iQ | File number, company name, the category code and any conditions of acceptability |
| IPC/WHMA-A-620 training | The individual's certificate, with its expiry date | Name, certification level, revision, expiry |
AS9100: check OASIS
The International Aerospace Quality Group (IAQG) maintains the Online Aerospace Supplier Information System, known as OASIS. Organizations holding an accredited AS9100, AS9110 or AS9120 certificate are entered in it by their certification body. Creating a basic OASIS account is free, and once logged in you can search for a supplier by name and see its certification details.
When you find the record, read it rather than just confirming the name appears:
- Standard. AS9100 applies to organizations that design and/or manufacture. AS9120 is for distributors and stockists. A distributor's AS9120 certificate does not cover building harnesses.
- Site. Certificates are issued per site or per group of sites. Confirm the address that will build your part is covered.
- Scope. The scope statement should describe the work you are buying, for example the manufacture of cable assemblies and wire harnesses.
- Status and dates. Check the certificate is current, and note when it expires.
An AS9100 certificate that does not appear in OASIS should be treated as unverified until the supplier and its certification body explain why. Many aerospace customers will not accept it in that state.
ISO 9001 and IATF 16949
ISO 9001 certificates are issued by many certification bodies, and not all of them are accredited. The International Accreditation Forum's CertSearch database lists certificates issued under accreditation by participating bodies. If a certificate is not there, check the certification body's own online register, and check that the body is accredited by a recognized accreditation body such as ANAB in the United States.
For automotive production parts, IATF 16949 certificates can be checked on the IATF Global Oversight website using the certificate number. The check returns whether the certificate is valid and the name of the certified organization.
ITAR, SAM.gov and CAGE
A manufacturer of defense articles, including cable assemblies built to defense drawings, is generally required to register with the US State Department's Directorate of Defense Trade Controls (DDTC). Registration must be renewed, so ask for the current registration letter and check its expiry date and company name. Registration shows the company is known to DDTC. It is not a license to export, and it does not by itself show that the company handles controlled technical data correctly, so also ask how your drawings will be stored and who can see them.
For federal work, search SAM.gov for the supplier's entity record. Confirm the registration is active and that the legal name, address and CAGE code match the quote. A CAGE code only identifies the entity. Check the SAM.gov exclusions list separately to confirm the company is not debarred or suspended.
UL wiring harness recognition
If your product's safety certification relies on a UL Recognized wiring harness, ask for the UL file number and check it in UL Product iQ. Wiring harnesses intended as factory-installed components are listed under the category code ZPFW2. Check that the company name matches, and read any conditions of acceptability that come with the recognition.
IPC/WHMA-A-620 training certificates
IPC/WHMA-A-620 training is certified per person, not per company. Operator and inspector certificates (Certified IPC Specialist, or CIS) and trainer certificates (CIT) are valid for two years and must be renewed. Ask for a current list of certified people, their level, and their expiry dates. A statement that a company "is IPC trained" does not tell you who is trained, or whether the training is current. See IPC/WHMA-A-620 classes for what the standard itself covers.
Honest gaps are fine; unverifiable claims are not. A start-up or a small shop may not yet hold some of these credentials. For prototypes and non-flight work that can be acceptable, if the supplier says so plainly. A credential listed on a website that cannot be found in its own register is a different matter.
Common questions
Is OASIS free to use?
A basic OASIS user account is free to create. It lets you search suppliers and view their AS9100-series certification details.
Can a company be "AS9100 compliant" without being certified?
A company can say it follows AS9100, but only an accredited certification body can certify it, and only a certified company appears in OASIS. Treat "compliant" as a statement of intent, and ask what stage the company has reached.
Does ITAR registration mean a supplier can export my part?
No. Registration is a prerequisite for most ITAR activities, but exports generally need their own license or exemption. Your own export compliance team should decide what is needed.
How often should I re-check?
At least at each supplier requalification, and before each new program. Many buyers also note the expiry date of each certificate and registration, and check again when it passes.
Where this fits
Verification is one step in choosing a manufacturer. If the record checks out, an on-site or remote supplier audit is the next step, followed by a first article inspection on your part.
Last reviewed 2026-09-17